Date: Sun, 17 Dec 2017 09:52:15 +0200 From: Sami Halabi <sodynet1@gmail.com> To: freebsd-net@freebsd.org, FreeBSD Current <freebsd-current@freebsd.org> Subject: need help using ng_patch to modify src/dst packets or alternative way Message-ID: <CAEW%2BogaxHp387AZGBBHQChz4VP5pH-TW9eCFGd2YeW_fcuVVSA@mail.gmail.com> In-Reply-To: <CAEW%2BogZ1-R97P6MhECcLYjdKr4ZFKUhnuMvk7r2eN2F8-E1LNA@mail.gmail.com> References: <CAEW%2BogbYXwMZUmbd%2BpmhgNPY-_7ZYHF4EeOWYgq%2B0iuG_hr2Mw@mail.gmail.com> <CAEW%2Bogae4BfmzSk4QU%2B4EHGE4E1BKO-mq2BAm1dvXCuh8DCYTg@mail.gmail.com> <CAEW%2BogZfrmj-ZJoCp_WExc5K4Gck-yFBUo5q%2BjJ6Wao3LygXmQ@mail.gmail.com> <CAEW%2BogYtdg2xUtyfWSLCwhyOypY-DT6c=BzOszcTMrCacp8jsQ@mail.gmail.com> <CAEW%2BogbJU5qtNsENkMA8-=kV8BsOMhP4biEsxtLfr-t54NE4=g@mail.gmail.com> <CAEW%2BogYzjpMzWSTxNDtKvEQgo3HpzuCgDh6Vs5_EKxM%2BCfGWtg@mail.gmail.com> <CAEW%2BogZpBhMpfZpRJa3LR_yzgeFWSRZhezaeVZ6JmYcoDy6xQg@mail.gmail.com> <CAEW%2BogZukjbh2zqcMWzc7R1zVzwyGiLfG=JZeZdcJbana5jhDg@mail.gmail.com> <CAEW%2BogbOVzpeDkDrWgDud8ttUVSPuaOEJ_Dw%2BQxfshZ4zTSVKQ@mail.gmail.com> <CAEW%2BogbaR=k1H2_1MYXjHCEKTFUYCo5k9cn-fOm3bT5VJaQpGg@mail.gmail.com> <CAEW%2BogZ1-R97P6MhECcLYjdKr4ZFKUhnuMvk7r2eN2F8-E1LNA@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
hi,
Can you help in my situation? My goal is so Box in my lan 10.1.1.2 to talk
to 10.1.1.1 and actually it would be talking to X.X.X.X outside ip using
one of my public IPs say 1.1.1.1.
I'm trying to modify packets to passthrough to a local IP.
I have a box that a specific IP is routed to it.. say 1.1.1.1
in my bce0 i don't have that ip configured but i have my public IP that say
2.2.2.2 that 1.1.1.1 is routed to it.
i configured 10.1.1.1/24 in bce0, my target box is 10.1.1.2/24.
i tried the following inside ngctl:
mkpeer ipfw: patch 300 in
name ipfw:300 src_dst_chg
msg src_dst_chg: setconfig { count=2 csum_flags=1 ops=[ { mode=1
value=0x0a010101 length=4 offset=3 } { mode=1 value=0x0a010102 length=4
offset=4 } ] }
in my box(10.1.1.1) i did:
sysctl net.inet.ip.fw.one_pass=0
/sbin/ipfw add 50 netgraph 300 ip from any to any to 1.1.1.1
then i do simple ping from outside box
i see the packets arrive on my 160 rule
but never leaves the box..
I would at least see packeta flow one direction to 10.1.1.2 and then that
need another ipfw and netgraph opposite rule.
If you have alternative way I'm happy to try...
Help much appreciated...
Sami
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAEW%2BogaxHp387AZGBBHQChz4VP5pH-TW9eCFGd2YeW_fcuVVSA>